SAML Signature Bypass in Red Hat Keycloak

Executive Summary

CVE-2026-16443 is a flaw in Keycloak's SAML Identity Provider metadata parser. When importing SAML metadata that sets 'WantAuthnRequestsSigned' to false and includes a KeyDescriptor without an explicit use attribute, the parser fails to enable signature validation for SAML responses. This allows an unauthenticated attacker to forge unsigned SAML responses and impersonate users by providing their external identifier.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Keycloak logs for SAML metadata import events where the 'WantAuthnRequestsSigned' field is set to false and KeyDescriptor lacks a usage attribute. Inspect SAML responses for missing signature validation in broker endpoints. Use network monitoring to detect unsigned SAML responses being accepted.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to bypass authentication, impersonate any federated user, and access or modify their data. The attack requires knowing the target user's external SAML identifier and capturing a valid RelayState and SAML request ID during a login flow. Successful exploitation grants full account access without authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user accounts, violating confidentiality and integrity requirements in GDPR and HIPAA. It may result in data breaches, unauthorized data access, or modification, leading to potential non-compliance with these regulations' security and privacy controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Keycloak to a patched version if available. Temporarily disable SAML authentication until patched. Review and update SAML metadata import configurations to ensure proper signature validation settings. Monitor for unauthorized access attempts.

Useful 0 Not Useful 0